Close the crash-window gap and exec-session leak a third review found

A third Opus review pass confirmed round 2's fixes hold up, then found:

- The pending-cleanup record `remove_project` writes is fully durable
  (fsync'd); the projects_store.remove() that follows it is a plain
  fs::write with no fsync. A crash or power loss in that window — or that
  store write failing outright, beyond what the previous round's in-process
  rollback catches — leaves a record on disk naming a project
  projects.json still lists as present. The very next startup retry would
  then delete that project's container, snapshot image, and both volumes
  (including the one holding the OAuth credential and every session
  transcript) out from under a project the user still sees in the sidebar.
  retry_pending_cleanup_logged now takes the ProjectsStore and refuses to
  touch — clearing instead — any record whose project id still exists.
  Also stopped swallowing the round-2 rollback's own failure.
- Resolving the container through find_existing_container instead of
  project.container_id (round 2's stale-id fix) changed what drove
  close_sessions_for_container in remove_project and rebuild_project_
  container: sessions are now leaked when Docker is unreachable (nothing
  resolves, so nothing closes, and the project record is gone a moment
  later) and in the stale-id race itself (sessions were opened against the
  container that actually exists, not the id find_existing_container
  bypasses). Both functions now close sessions for the stored id
  unconditionally, and again for the resolved id if it differs.
- A pronoun-agreement bug in the no-retry removal toast ("remove them
  manually" for a single leftover) that was fixed one line above for verb
  agreement but not for the pronoun.

Also closed the test gaps the review named: the pending-cleanup
corrupt-record aside-move had no test, the Reset toast's leftover copy
was inline and untested (extracted to lib/resetOutcome.ts, mirroring
components/projects/home/removalReport.ts, with unit tests), and nothing
asserted rebuild()'s success path maps outcome.project into the list
rather than the whole outcome.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FGjXq6fqtAFHdbhk4f3PfZ

app/src/components/projects/home/ProjectHome.tsx

@@ -19,7 +19,7 @@ import ConfigTab from "./ConfigTab";
 import FilesTab from "./FilesTab";
 import BrowserTab from "./BrowserTab";
 import { formatUptime } from "./format";
-import { describeLeftovers, leftoverVerb } from "./removalReport";
+import { describeLeftovers, leftoverPronoun, leftoverVerb } from "./removalReport";
 
 const TABS = [
   { id: "overview", label: "Overview" },
@@ -299,7 +299,7 @@ export default function ProjectHome({ projectId, active }: Props) {
                   useAppState.getState().pushToast({
                     kind: "error",
                     message: `“${project.name}” was removed, but Triple-C could not confirm its Docker resources were removed`,
-                    detail: `Triple-C could not confirm ${describeLeftovers(report)} ${verb} removed, and could not record this for a retry. You may need to remove them manually (\`docker rm\` / \`docker rmi\` / \`docker volume rm\`).`,
+                    detail: `Triple-C could not confirm ${describeLeftovers(report)} ${verb} removed, and could not record this for a retry. You may need to remove ${leftoverPronoun(report)} manually (\`docker rm\` / \`docker rmi\` / \`docker volume rm\`).`,
                   });
                 }
               }

app/src/components/projects/home/removalReport.ts

@@ -18,9 +18,22 @@ export function describeLeftovers(report: ProjectRemovalReport): string {
   return parts.join(", ");
 }
 
+/** How many distinct things `describeLeftovers` is describing — a container
+ *  and an image each count as one, however many volumes are named. Shared by
+ *  `leftoverVerb` and `leftoverPronoun` so the two can never disagree about
+ *  singular vs. plural. */
+function leftoverCount(report: ProjectRemovalReport): number {
+  return (report.container ? 1 : 0) + (report.image ? 1 : 0) + report.volumes.length;
+}
+
 /** Verb agreement for `describeLeftovers`'s output — "its container" needs
  *  "was", "its container, a volume" needs "were". */
 export function leftoverVerb(report: ProjectRemovalReport): "was" | "were" {
-  const count = (report.container ? 1 : 0) + (report.image ? 1 : 0) + report.volumes.length;
-  return count === 1 ? "was" : "were";
+  return leftoverCount(report) === 1 ? "was" : "were";
+}
+
+/** Pronoun agreement for referring back to `describeLeftovers`'s output —
+ *  "remove it manually" for one thing, "remove them manually" for more. */
+export function leftoverPronoun(report: ProjectRemovalReport): "it" | "them" {
+  return leftoverCount(report) === 1 ? "it" : "them";
 }

app/src/hooks/useProjectActions.ts

@@ -3,6 +3,7 @@ import { save } from "@tauri-apps/plugin-dialog";
 import type { Project } from "../lib/types";
 import * as commands from "../lib/tauri-commands";
 import { formatBytes } from "../lib/formatBytes";
+import { describeResetLeftovers, resetLeftoverPronoun } from "../lib/resetOutcome";
 import { useAppState } from "../store/appState";
 import { useProjects } from "./useProjects";
 import { useTerminal } from "./useTerminal";
@@ -58,12 +59,7 @@ export function useProjectActions(project: Project) {
     () =>
       run("Reset", async () => {
         const outcome = await rebuild(project.id);
-        const { leftover_image, leftover_volumes } = outcome;
-        if (leftover_image || leftover_volumes.length > 0) {
-          const parts: string[] = [];
-          if (leftover_image) parts.push("its previous container image");
-          if (leftover_volumes.length === 1) parts.push("a volume");
-          else if (leftover_volumes.length > 1) parts.push(`${leftover_volumes.length} volumes`);
+        if (outcome.leftover_image || outcome.leftover_volumes.length > 0) {
           // Not "run `docker volume rm`" — by the time this renders, the new
           // container this same call just started already has the leftover
           // volume mounted, so that command would just hit the same 409
@@ -71,9 +67,9 @@ export function useProjectActions(project: Project) {
           pushToast({
             kind: "error",
             message: `Reset for “${project.name}” did not fully clean up`,
-            detail: `Triple-C could not remove ${parts.join(" and ")} from before the reset, so \
+            detail: `Triple-C could not remove ${describeResetLeftovers(outcome)} from before the reset, so \
 the new container may still be built from, or contain, old data. Stop the project, then try \
-Reset again, or remove ${parts.length > 1 ? "them" : "it"} manually once stopped.`,
+Reset again, or remove ${resetLeftoverPronoun(outcome)} manually once stopped.`,
           });
         }
         return outcome;

app/src/hooks/useProjects.test.ts

@@ -140,3 +140,27 @@ describe("useProjects puts the status back when a refused command never ran", ()
     expect(statusOf()).toBe("stopped");
   });
 });
+
+describe("useProjects.rebuild on success", () => {
+  it("puts the outcome's project, not the whole outcome, into the list", async () => {
+    const rebuilt = project("running");
+    rebuildProjectContainer.mockResolvedValue({
+      project: rebuilt,
+      leftover_image: null,
+      leftover_volumes: [],
+    });
+
+    const { result } = renderHook(() => useProjects());
+    let outcome!: Awaited<ReturnType<typeof result.current.rebuild>>;
+    await act(async () => {
+      outcome = await result.current.rebuild("p1");
+    });
+
+    // A regression here would put the `{ project, leftover_image,
+    // leftover_volumes }` wrapper into the projects list instead of the
+    // `Project` it wraps — a shape mismatch `tsc` would not catch inside a
+    // callback typed to take `unknown` per Tauri's `invoke`.
+    expect(useAppState.getState().projects.find((p) => p.id === "p1")).toEqual(rebuilt);
+    expect(outcome.leftover_volumes).toEqual([]);
+  });
+});

app/src/lib/resetOutcome.test.ts

@@ -0,0 +1,39 @@
+import { describe, it, expect } from "vitest";
+import { describeResetLeftovers, resetLeftoverPronoun } from "./resetOutcome";
+import type { ProjectResetOutcome } from "./types";
+
+function outcome(overrides: Partial<ProjectResetOutcome> = {}): ProjectResetOutcome {
+  return {
+    project: {} as ProjectResetOutcome["project"],
+    leftover_image: null,
+    leftover_volumes: [],
+    ...overrides,
+  };
+}
+
+describe("describeResetLeftovers", () => {
+  it("names the image first, then the volumes", () => {
+    expect(describeResetLeftovers(outcome({ leftover_image: "x" }))).toBe(
+      "its previous container image",
+    );
+    expect(describeResetLeftovers(outcome({ leftover_volumes: ["v1"] }))).toBe("a volume");
+    expect(describeResetLeftovers(outcome({ leftover_volumes: ["v1", "v2"] }))).toBe("2 volumes");
+    expect(
+      describeResetLeftovers(outcome({ leftover_image: "x", leftover_volumes: ["v1", "v2"] })),
+    ).toBe("its previous container image and 2 volumes");
+  });
+});
+
+describe("resetLeftoverPronoun", () => {
+  it("is singular for exactly one leftover", () => {
+    expect(resetLeftoverPronoun(outcome({ leftover_image: "x" }))).toBe("it");
+    expect(resetLeftoverPronoun(outcome({ leftover_volumes: ["v1"] }))).toBe("it");
+  });
+
+  it("is plural once more than one thing survived", () => {
+    expect(resetLeftoverPronoun(outcome({ leftover_image: "x", leftover_volumes: ["v1"] }))).toBe(
+      "them",
+    );
+    expect(resetLeftoverPronoun(outcome({ leftover_volumes: ["v1", "v2"] }))).toBe("them");
+  });
+});

app/src/lib/resetOutcome.ts

@@ -0,0 +1,32 @@
+import type { ProjectResetOutcome } from "./types";
+
+/**
+ * Names what a `ProjectResetOutcome` says Reset could not clear, for
+ * `useProjectActions`'s Reset toast.
+ *
+ * The image is named first and phrased as "its previous container image"
+ * rather than folded in with the volumes — it is the more serious of the
+ * two: the new container is built from it whenever it exists, so a
+ * surviving image means Reset silently rebuilt the exact system layer it
+ * was asked to discard, while a surviving volume only means old data rides
+ * along.
+ */
+export function describeResetLeftovers(outcome: ProjectResetOutcome): string {
+  const parts: string[] = [];
+  if (outcome.leftover_image) parts.push("its previous container image");
+  if (outcome.leftover_volumes.length === 1) parts.push("a volume");
+  else if (outcome.leftover_volumes.length > 1) parts.push(`${outcome.leftover_volumes.length} volumes`);
+  return parts.join(" and ");
+}
+
+/** How many distinct things `describeResetLeftovers` is describing — the
+ *  image counts as one, however many volumes are named alongside it. */
+function resetLeftoverCount(outcome: ProjectResetOutcome): number {
+  return (outcome.leftover_image ? 1 : 0) + outcome.leftover_volumes.length;
+}
+
+/** Pronoun agreement for referring back to `describeResetLeftovers`'s
+ *  output — "remove it manually" for one thing, "remove them" for more. */
+export function resetLeftoverPronoun(outcome: ProjectResetOutcome): "it" | "them" {
+  return resetLeftoverCount(outcome) === 1 ? "it" : "them";
+}